A valid request URL is required to generate request examples{
"scanJobId": "cmrasmw4702sdstu9j4iq1x55",
"id": "<string>",
"repository": {
"id": "<string>",
"fullName": "my-org/payments-api",
"newlyCreated": true
}
}{
"error": "Invalid or expired API token"
}{
"error": "API token missing required scope",
"required": "scans:trigger",
"granted": [
"scans:read"
]
}{
"error": "<string>",
"code": "<string>",
"message": "<string>"
}Trigger a scan by GitHub repo (auto-onboard)
Auto-onboards the repository on first run — requires the BreachLens GitHub App installed on that account — then queues a scan. Requires the scans:trigger scope. Returns 503 if GitHub App auth is unavailable (App not installed / not authorized).
A valid request URL is required to generate request examples{
"scanJobId": "cmrasmw4702sdstu9j4iq1x55",
"id": "<string>",
"repository": {
"id": "<string>",
"fullName": "my-org/payments-api",
"newlyCreated": true
}
}{
"error": "Invalid or expired API token"
}{
"error": "API token missing required scope",
"required": "scans:trigger",
"granted": [
"scans:read"
]
}{
"error": "<string>",
"code": "<string>",
"message": "<string>"
}Authorizations
Scoped API token from Settings → API Tokens (scopes: scans:trigger, scans:read).
Headers
Cloudflare Access service-token client id (ends in .access). Only for CF-Access-fronted deployments; leave blank for self-hosted.
Cloudflare Access service-token secret. Pair it with CF-Access-Client-Id.
Body
owner/name of the GitHub repository.
"my-org/payments-api"
Commit SHA (CI metadata for auto-discovery).
"a1b2c3d4"
Branch name (CI metadata).
"main"
PR/MR number (CI metadata).
42
Scan tiers to run. Omit for the server default (SAST, SCA, SECRET, IAC for repositories). Valid values depend on target type.
["SAST", "SCA", "SECRET", "IAC"]